CVE-2022-49556

published 2025-02-26

CVE-2022-49556: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak For some sev…

Priority P4 30 high 7.1 CVSS 3.1

AV L AC L PR L UI N S U C H I N A H

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak

For some sev ioctl interfaces, the length parameter that is passed maybe
less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data
that PSP firmware returns. In this case, kmalloc will allocate memory
that is the size of the input rather than the size of the data.
Since PSP firmware doesn't fully overwrite the allocated buffer, these
sev ioctl interface may return uninitialized kernel slab memory.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.2-1 (bookworm)	linux 5.18.2-1 (bookworm)
linux	linux	—	—
linux	linux	>= eaf78265a4ab33935d3a0f1407ce4a91aac4d4d5 < 401bef1f95de92c3a8c6eece46e02fa88d7285ee	401bef1f95de92c3a8c6eece46e02fa88d7285ee
linux	linux	>= eaf78265a4ab33935d3a0f1407ce4a91aac4d4d5 < d8fdb4b24097472ff6b3c0559448200d420b1418	d8fdb4b24097472ff6b3c0559448200d420b1418
linux	linux	>= eaf78265a4ab33935d3a0f1407ce4a91aac4d4d5 < bbdcc644b59e01e98c68894a9fab42b9687f42b0	bbdcc644b59e01e98c68894a9fab42b9687f42b0
linux	linux	>= eaf78265a4ab33935d3a0f1407ce4a91aac4d4d5 < 57a01725339f9d82b099102ba2751621b1caab93	57a01725339f9d82b099102ba2751621b1caab93
linux	linux	>= eaf78265a4ab33935d3a0f1407ce4a91aac4d4d5 < d22d2474e3953996f03528b84b7f52cc26a39403	d22d2474e3953996f03528b84b7f52cc26a39403
linux	linux_kernel	>= 0 < 5.10.127-1	5.10.127-1
linux	linux_kernel	>= 0 < 5.18.2-1	5.18.2-1
linux	linux_kernel	>= 0 < 5.18.2-1	5.18.2-1
linux	linux_kernel	>= 0 < 5.18.2-1	5.18.2-1
linux	linux_kernel	>= 5.11 < 5.15.45	5.15.45
linux	linux_kernel	>= 5.16 < 5.17.13	5.17.13
linux	linux_kernel	>= 5.18 < 5.18.2	5.18.2
linux	linux_kernel	>= 5.7 < 5.10.124	5.10.124

CVSS provenance

nvd v3.1 7.1 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

osv 7.1 HIGH

vendor_debian 7.1 HIGH

vendor_redhat 7.1 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.